Modelling metamorphism by abstract interpretation

Mila Dalla Preda, Roberto Giacobazzi, Saumya Debray, Kevin Coogan, Gregg M. Townsend

Research output: Chapter in Book/Report/Conference proceedingConference contribution

17 Scopus citations

Abstract

Metamorphic malware apply semantics-preserving transformations to their own code in order to foil detection systems based on signature matching. In this paper we consider the problem of automatically extract metamorphic signatures from these malware. We introduce a semantics for self-modifying code, later called phase semantics, and prove its correctness by showing that it is an abstract interpretation of the standard trace semantics. Phase semantics precisely models the metamorphic code behavior by providing a set of traces of programs which correspond to the possible evolutions of the metamorphic code during execution. We show that metamorphic signatures can be automatically extracted by abstract interpretation of the phase semantics, and that regular metamorphism can be modelled as finite state automata abstraction of the phase semantics.

Original languageEnglish (US)
Title of host publicationStatic Analysis - 17th International Symposium, SAS 2010, Proceedings
Pages218-235
Number of pages18
DOIs
StatePublished - Nov 12 2010
Event17th International Static Analysis Symposium, SAS 2010 - Perpignan, France
Duration: Sep 14 2010Sep 16 2010

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume6337 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Other

Other17th International Static Analysis Symposium, SAS 2010
CountryFrance
CityPerpignan
Period9/14/109/16/10

Keywords

  • Abstract interpretation
  • malware detection
  • metamorphic code
  • program transformation
  • security
  • semantics
  • static analysis

ASJC Scopus subject areas

  • Theoretical Computer Science
  • Computer Science(all)

Fingerprint Dive into the research topics of 'Modelling metamorphism by abstract interpretation'. Together they form a unique fingerprint.

  • Cite this

    Dalla Preda, M., Giacobazzi, R., Debray, S., Coogan, K., & Townsend, G. M. (2010). Modelling metamorphism by abstract interpretation. In Static Analysis - 17th International Symposium, SAS 2010, Proceedings (pp. 218-235). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 6337 LNCS). https://doi.org/10.1007/978-3-642-15769-1_14